Privacy policy

For creators' accounts, billing and use of our website, we decide how and why data is used, so we are the controller.

For buyers' and subscribers' details collected through a creator's store, the creator decides what to do with them. We handle that data only on the creator's behalf and on their instructions, so we are the processor and the creator is the controller. If you bought from a creator and want to use your rights, please contact that creator first. We will help them respond.

• Account details: your name, email address and sign-in method (an emailed link or Google)
• Store details: your store name, address, tagline, photos, products, files, prices and settings
• Payment details: your connected Stripe account status, VAT settings and your plan and billing history. Card numbers for your plan are handled by Stripe and we never see them
• Usage and device data: pages you visit in the dashboard, technical logs such as IP address and browser, used to keep the service secure and working
• Email sender details: the sender name, reply-to address and postal address you give us, and the emails you write. Recipients see your sender name, reply-to address and postal address
• Referral details: a referral code you use or share, and the PayPal email address you give us so we can pay your referral commission
• Messages you send to us

When someone buys, starts a checkout or claims a free product from a creator's store, we process their email address, name where given, what they bought, the amount, any discount code used, and the details needed to deliver the file and send a receipt. Card details go directly to Stripe and are not stored by us. Where a creator adds a review or testimonial, we store what the creator publishes.

When someone visits a creator's store or product page, we record which page they looked at, the website that sent them (the site name, not the full address), any campaign tag in the link (utm_source), their country and a daily visitor id. Each row also keeps the time of the visit. The id is a one-way code made by scrambling their IP address and browser details with the store's id and a secret value that changes each day, so the same person gets a different id on another day. We delete each day's secret once the next day's first visit arrives. We don't store the IP address or browser details, and we use no cookie. Creators see this for their own store as totals, plus the page, website, campaign tag, country and day of each visit. They can't see the visitor id or the exact time, and these records don't include a visitor's name, email or IP address. On a store with few visitors, or if a creator sends someone a link with its own campaign tag, these details could still show them who a visit came from. Basis: our legitimate interest in showing creators how their store is doing.

Creators can email their contacts through stall.bio. The creator controls their contact list and decides what to send, so the creator is the controller and we are their processor. We send only what is described here.

Asking to hear from a creator

If someone ticks "Send me updates from {store}" when they claim a free product or at checkout, or uses a store's sign-up page, we add them to that creator's contacts as waiting to confirm and send them one confirmation email. On a paid checkout, that email goes only once the order is paid. Ticking the box doesn't mean they get marketing email: they only get it after opening the link in that email and pressing the button on the page it opens, within 14 days. We don't send a second confirmation within 24 hours, or more than three unanswered in 30 days. If someone else typed your address, ignore the email and you won't get any updates, although your address stays on that creator's contacts list as waiting to confirm until the creator deletes it.

Imported contacts

A creator can upload a list of their own contacts, with names and tags. Uploading sends nothing. If the creator tells us those people agreed to hear from them, each person gets one invitation to confirm, and nothing else from that upload unless they confirm. The link works for 14 days. Uploading the same person again doesn't send another invitation. The creator is responsible for that statement being true.

Emails from a creator

Once someone has confirmed, the creator can send them one-off emails, and automated emails after they confirm or after they buy. These can use the person's first name where the creator has it. Someone who hasn't confirmed doesn't get these, even if they have bought from that creator. Receipts and access emails are separate and go to every buyer.

Abandoned-checkout reminders

A creator can switch these on for their store. When they are on, a paid checkout shows the notice "If you don't finish, {store} may email you one reminder", with a "Don't remind me" tick. If someone saw that notice, started a checkout, didn't complete it and didn't tick the box, they may get one reminder, at least an hour later and no more than about a day later. It names the product and links to its page.

Limits: one reminder per store in 30 days, and three to the same address across all stores in 30 days. Ticking "Don't remind me" holds for that store for 30 days. No reminder goes if the person has since bought the product, has unsubscribed, or the product is sold out or no longer on sale.

When a reminder is prepared for someone not already in that creator's contacts, they appear there as having started checkout, with status "not asked", and those contacts appear in the creator's contact export. A reminder doesn't put anyone on the list for other marketing email.

Unsubscribing

Every marketing email has an unsubscribe link. The confirmation email is the one exception to the visible link: if you ignore it, you get nothing more. Opening a confirm or unsubscribe link changes nothing by itself. It takes pressing the button on the page, or using the one-click unsubscribe your mail app may offer. An unsubscribe applies to that creator's store. Receipts and access emails still arrive. If you later ask for that creator's updates again and confirm, the unsubscribe is lifted. A spam complaint isn't lifted that way, and no further confirmation is sent. An address that bounces permanently isn't sent marketing email from any store.

Tracking

We don't use open tracking or click tracking. Links in a creator's emails and reminders carry a tag (utm_source=stall-email), the same for everyone, so a store's analytics can count visits from email. Those visits are recorded as described above. Pictures in an email load from our file storage. For each email we record whether it was sent, delivered, bounced or marked as spam, as Resend reports it, and the dashboard shows creators totals for each email they send.

What we keep

• Consent records: the address, the store, what happened (asked, invited, confirmed or unsubscribed), how, the time, and the exact wording shown where there was any or, for an invitation, the statement the creator agreed to. We don't record an IP address or browser details here. Creators can't read these records.
• Suppression lists: addresses we must not send marketing email to, with the reason and the time. They are kept after a contact is deleted, so that deleting and re-uploading someone can't undo an unsubscribe. Unsubscribes and spam complaints stop that store's mail. A permanent bounce stops mail from every store. We keep that list ourselves, to keep email working for everyone. Our email provider may also stop an address that complained or bounced from getting mail from other stores on stall.bio. Order emails come from a separate account and aren't affected.
• Queue records: one record for each email, with the address, its type and what happened to it. These keep the address after a contact is deleted. They include reminder records marked as skipped, where no reminder went, and those can exist for someone who isn't in the creator's contacts at all. Creators can't read these records: they see totals.
• Invitation records: the address and the sender details used, kept after a contact is deleted, so that nobody is invited twice.

See "How long we keep data" below.

Every creator has a referral code. If someone invites you with a link such as stall.bio/r/code, the invitation page shows the inviter's store name, but only if their store is live. If you sign up with a code, it is saved in a cookie until sign-in finishes and in your sign-in details, where it stays with your account, so we can link your account to the person who invited you.

The person who invited you sees only counts and totals, such as how many people signed up, how many are paying and what they have earned. They don't see your name or email. If you are the only person they invited, those totals may show whether you are paying.

To pay commission we keep the PayPal email address you give us. The PayPal email on your profile is removed when your account is deleted. When we pay you, we record the amount, the date and the PayPal address we paid. We keep that record for our accounts, even after your account is deleted, because tax and accounting rules require it. Basis: contract and legal obligation.

• To provide the service you signed up for, including running your store and delivering orders. Basis: performing our contract with you
• To take payment for your plan and meet tax and accounting rules. Basis: contract and legal obligation
• To keep stall.bio secure, prevent fraud and fix problems. Basis: our legitimate interest in running a safe service
• To send service emails such as sign-in links, receipts and important notices. Basis: contract and legitimate interest
• To improve the service and answer your questions. Basis: legitimate interest
• To send a creator's marketing email on their instructions, including the confirmation email, the invitation and reminders. The creator is responsible for the lawful basis for what they send
• To keep consent records and suppression lists, stop sending to addresses that don't work, and pause a store whose email is bouncing or being reported as spam, so that one creator can't damage delivery for others. Basis: legitimate interest
• To store your cookie choice and show prices in your currency, as set out on our cookies page. Basis: these are essential, so no consent is needed

We don't sell personal data. We don't use it for advertising profiling.

We use a small number of other companies to run stall.bio. They process data on our behalf, or on a creator's behalf, under written terms:

• Stripe for payments and creators' payouts. Stripe is also an independent controller for its own legal and fraud checks
• Supabase for our database, sign-in and file storage
• Resend for sending emails such as receipts, sign-in links and download links, and creators' marketing emails. Resend receives the recipient's address and the email's content, and tells us whether it was delivered, bounced or marked as spam
• Vercel for hosting the website and its servers
• PayPal for paying referral commission. We give PayPal the address of the referrer we are paying. PayPal handles that address under its own privacy notice.

When a creator adds a YouTube video to their store, its thumbnail image loads from Google's servers (i.ytimg.com) as the store page opens, before a visitor taps play, so Google receives that visitor's IP address and browser details. The video itself loads only after a tap, through YouTube's privacy-enhanced mode (youtube-nocookie.com).

We may also share data when the law requires it, to protect people from harm, or if the business is sold, in which case the new owner must keep honouring this policy.

Some of the companies above are based, or store data, outside the UK. When data is transferred we make sure a lawful safeguard is in place, such as the UK's adequacy regulations or the UK International Data Transfer Addendum to standard contractual clauses.

We keep creator account data while the account is open and for a reasonable period afterwards so you can come back or ask for your data. Billing records are kept for as long as UK tax law requires, currently six years. Buyers' order records are kept while the creator's account is open, because creators need them for their own records. Records of page visits to creators' stores are deleted after about 400 days, which is around 13 months. We haven't set a fixed period for consent records, suppression lists, queue records and invitation records. They are kept for as long as the creator's store exists, including after a contact is deleted, and are deleted with the store. The exception is a permanent bounce, which isn't tied to any store and is kept with no end date. Server logs are kept for a short period and then deleted. If you want something deleted sooner, ask us and we'll tell you what we can remove. Removing an address from a suppression list would let it be emailed again, so we may need to keep that entry.

Under UK data protection law you can ask us to:

• tell you what data we hold about you and give you a copy
• correct data that's wrong
• delete your data, in some situations
• restrict or object to some of our uses of it
• give you your data in a portable format, where the law allows

To use any of these, email [Contact email]. We'll reply within one month. If you aren't happy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd be grateful for the chance to put things right first.

We protect data with encrypted connections, access controls on our database and private storage for files that buyers have paid for. No system is perfectly secure. If a breach affects your data in a way that puts you at risk, we'll tell you and the regulator as the law requires.

stall.bio is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has given us their data, contact us and we'll delete it.

If we change this policy in a way that matters, we'll update the date at the top and tell account holders by email or in the dashboard.